The stable importer accepts SARIF 2.1.0 only. It normalizes each non-suppressed result into imported evidence, preserves the external tool and rule identity, and evaluates the resulting finding through the standard Fendix pipeline.
Accepted structure and normalization
| Input | Behavior |
|---|---|
| tool.driver.name | Normalized into external ToolID; an empty/invalid name becomes unknown-tool. |
| ruleId / ruleIndex | Resolves the external rule; ruleId is preserved in imported provenance. |
| result.level | Falls back to rule.defaultConfiguration.level, then warning. |
| security-severity | When present, overrides level for intrinsic severity using the documented thresholds. |
| locations[0] | First physical location becomes the normalized endpoint and optional line range; no usable location becomes unknown. |
| relationships / taxa / tags / cwe | Structured CWE mentions are normalized into Weakness; message prose is never parsed for CWE. |
| partialFingerprints | Preserved as source provenance references; Fendix computes its own identity separately. |
| suppressions | Accepted or status-less suppressions are counted and skipped. |
Severity and confidence normalization
| Source signal | Fendix value |
|---|---|
| level: error | severity: HIGH |
| level: none | severity: INFO |
| level: note | severity: INFO |
| level: warning | severity: MEDIUM |
| precision: high | confidence: HIGH |
| precision: low | confidence: LOW |
| precision: medium | confidence: MEDIUM |
| precision: very-high | confidence: HIGH |
score >= 9.0: CRITICAL · score >= 7.0: HIGH · score >= 4.0: MEDIUM · score < 4.0: LOW
Trust and provenance boundary
- source is imported
- source tier is unset
- codeFlows do not establish native reachability
- route and taint chain are not trusted from imported SARIF
Two independent tools reporting the same normalized CWE at the same normalized location can establish CrossToolCorroborated. The independent tool identities remain in CorroboratingTools. This can support confidence, but it does not prove exploitation, reachability, or production impact.
Malformed and unsupported input
Malformed JSON, data that does not look like SARIF, and any version other than 2.1.0 fail explicitly. Missing optional rule metadata falls back conservatively; a result without a usable location is retained as unknown and counted instead of being silently dropped.
Validated import example
Contract generation parses and normalizes this compact external-tool document.
{
"version": "2.1.0",
"$schema": "https://json.schemastore.org/sarif-2.1.0.json",
"runs": [
{
"tool": {
"driver": {
"name": "ExampleSAST",
"semanticVersion": "4.2.0",
"rules": [
{
"id": "EXT-SQL-001",
"shortDescription": {
"text": "SQL query built from request input"
},
"helpUri": "https://example.invalid/rules/EXT-SQL-001",
"properties": {
"tags": [
"external/cwe/CWE-89"
],
"precision": "high",
"security-severity": "8.0"
}
}
]
}
},
"results": [
{
"ruleId": "EXT-SQL-001",
"level": "error",
"message": {
"text": "Request parameter reaches a SQL query."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"uri": "src/users.py"
},
"region": {
"startLine": 42
}
}
}
],
"partialFingerprints": {
"example/v1": "safe-example-identity"
}
}
]
}
]
}Related reference
fendix import · Evidence and provenance · Finding fingerprints